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I. ALGEBRA 

J.E. CREMONA, T.A. FISHER, C. O'NEIL, D. SIMON, AND M. STOLE 

Abstract. This is the first in a series of papers in which we study 
the n-Selmer group of an elhptic curve, with the aim of representing 
its elements as genus one normal curves of degree n. The methods 
we describe are practical in the case n = 3 for elliptic curves over 
the rationals, and have been implemented in MAGMA . 



Introduction 

Descent on an elliptic curve E, defined over a number field K, is a 
method for obtaining information about both the Mordell-Weil group 
E{K) and the Tate-Shafarevich group UI{E/K). Indeed for each in- 
teger n > 2 there is an exact sequence 

^ E{K)/nE{K) Sei^'^^E/K) ^ m{E/K)[n] 

where Se\^'^\E/K) is the n-Selmer group. 

This is the first in a series of papers in which we study the n-Selmer 
group with the aim of representing its elements as genus one normal 
curves C C P"^^ (when n > 3). Having this representation allows 
searching for rational points on C (which in turn gives points in E{K), 
since C may be seen as an n-covering of E) and is a first step towards 
doing higher descents. A further application is to the study of explicit 
counter-examples to the Hasse Principle. 

In this introduction we discuss our approach to the problem and set 
out the goals of our work. Following some historical remarks, we will 
outline the contents of this first paper, and then briefly that of the 
remaining papers in the series. 

The method of descent, for explicitly determining the solutions of 
Diophantine Equations, has a long and distinguished history going back 
(at least) to Fermat. As a tool for the determination of the Mordell- 
Weil groups of elliptic curves over number fields, descent has been used 
since the very first applications of computing to number theory. Until 
the 1990s, the only methods which had been implemented for general 



Date: 1st March 2006. 



1 



2 J.E. CREMONA, T.A. FISHER, C. O'NEIL, D. SIMON, AND M. STOLL 



elliptic curves were based on 2-descent and could be applied only to 
elliptic curves defined over Q, though of course individual examples 
had been worked out over other fields. The advent of higher-level 
computer algebra software and the development of efficient algorithms 
for handling the arithmetic of more general number fields has meant 
that 2-descent can now be carried out over general number fields (of 
moderate degree and discriminant, for practical reasons). We may cite 
both Simon's gp program ell.gp (see [IT]), and the MAGMA package 
written primarily by Bruin, as examples of this which are widely used. 

The situation regarding so-called higher descents, meaning n-descent 
for n > 2, has until now been much more fragmentary and less satisfac- 
tory. Some 3-descents (for twists of Fermat curves) and certain other 
descents via isogeny have been studied systematically, but these ap- 
ply only to special families and not to general elliptic curves (at least, 
not without an extension of the ground field, which introduces further 
complexities and complicates implementation significantly). Higher 2- 
power descents (also known as second and third 2-descents) have been 
studied and implemented by Siksek ^9J and Womack |19j for 4-descent, 
and by Stamminger |TS1 for 8-descent. 

In the case of 2-descent, the map C ^ is a double cover rather 
than an embedding, and the elements of Se[^'^\E/K) are represented 
as curves of the form Y'^ = g{X) where g is a quartic. Our goal is to be 
equally explicit for all n > 2. The methods we present are fully worked 
out for all odd prime n, and have been implemented in MAGMA P| in 
the case n = 3 for elliptic curves over Q. This implementation will be 
included in MAGMA version 2.13, to be released later this year. 

To avoid making assumptions about the Galois module structure of 
E[n], we work with the etale algebra R of E[n\. This is a ii'-algebra 
of dimension n^, explicitly realised as a product of number fields. The 
starting point for our work is the paper of Schaefer and StoU [H], which 
improves on earlier methods in They show that if n is prime then 
a certain group homomorphism 

wi ■.H\K,E[n])^ R''/{R''Y 

is injective, and determine its image. This is the basis of an algorithm 
for computing '^e\^'^\E / K) as a subgroup of R^/{R^)"'. (In fact they 
assume that n is odd, since the case n = 2 was already well known.) 
The algorithm requires knowledge of the class group and unit group of 
each constituent field of R. 

In 121 we replace Wi by a group homomorphism 

W2 : H\K,E[n]) {R^Ry/dR'' 
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where d : — >• {R ® R)^ is a certain map. We show that W2 is 
injective for all n > 2 and determine its image. If n is prime then it is 
possible to convert the subgroup of R^/{R^)^ computed by Schaefer 
and Stoll to a subgroup of {R (E) R)^ /dR^ . Since R (E) R is the etale 
algebra of E[n] x E[n], it is again a product of number fields. In 
principle one could compute the n-Selmer group directly as a subgroup 
of {R® R)^ /dR^ , but this would require knowledge of the class group 
and unit group of each constituent field of R^ R, and in general these 
fields have larger degree than those appearing in R. 

Our goal is now the following. We must convert elements of Sel^**^ {E/K) 
represented algebraically by p e (i? (8) i?) ^ , to elements of Sel^'^\E/K) 
represented geometrically by (equations for) genus one normal curves 
C C P"~^. We present three algorithms for performing this conversion, 
the second and third of which apply for arbitrary n > 2. In particular 
we have no need to assume that n is prime. In the case n — 2 our third 
algorithm reduces to the classical number field method for 2-descent. 
Nevertheless we assume for ease of exposition that n > 3. 

We give a brief description of each algorithm. 

The Hesse pencil method. Wc determine n x n matrices (with 
entries in an extension of K) that represent the action of E[n] on 
C C P"~^. At least in the case n = 3 it is then practical to recover an 
equation for C. 

The flex algebra method. We embed E C P"'"^ via the complete 
hnear system |n.0| where is the identity on E. We then determine 

a change of co-ordinates (defined over an extension of K) that takes 
E C P"~^ to C C P"~^. We use this change of co-ordinates to compute 
equations for C. 

The Segre embedding method. We determine equations for C as a 
curve of degree in the rank 1 locus of P(Matji). Thus C lies in the 
image of the Segre embedding 

pn-l ^ (pn-l)V ^ p(Mat„). 

We pull back to P"~^ x (P""^)^ and then project onto the first factor 
to get C C P"-^ 

It is important to realise that not every element of H^{K, E[n]) can 
be represented by a genus one normal curve C C P"^^. Those elements 
of H^{K, E[n\) that can be represented in this way form the "kernel" 
of the obstruction map 

Ob : H^{K,E[n]) Br(X) 
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where Br(i^") is the Brauer group of K. The reader is warned that 
in general the obstruction map is not a group homomorphism, and its 
kernel is not a group. 

In fact each of our algorithms works over an arbitrary field K (as- 
sumed perfect and with char(fC)j'n) provided we make the following 
hypotheses: 

• We start with an element p G {R ® R)^ that represents an 
element of H^{K^E[ri\) with trivial obstruction. 

• We have access to a "Black Box" that, given structure constants 
for a i^-algebra known to be isomorphic to Mat„(-ft'), finds such 
an isomorphism explicitly. 

Returning to the case K a number field, it follows by the commuta- 
tivity of the diagram 

H\K, E[n]) Br(ir) 

and the injectivity of the right hand map, that an element of H^{K, E[n]) 
has trivial obstruction if and only if it has trivial obstruction every- 
where locally. We deduce that Sel^"'\E/K) is contained in the kernel 
of the obstruction map. In our algorithms it then becomes necessary 
to use an explicit version of the local-to-global principle for the Brauer 
group. This role is played by the Black Box. An essentially equivalent 
problem is that of finding a rational point on a Brauer-Severi variety 
of dimension n — 1. In the case n = 2 this means finding a rational 
point on a conic, a task which we recognise as one of the steps in the 
classical number field method for 2-descent, cf. PJ, §15. 

We present our work in a series of papers, of which this is the first. 
We briefly summarise the contents of each. 

Paper I: Algebra. We work over a perfect field K with char(A') \ 
n. We give a list of interpretations of the Galois cohomology group 
H^{K, E[n\), and explore the relationships between them. Then we go 
through several different descriptions of the obstruction map and check 
that they are all equivalent. In ^we introduce the etale algebra R of 
E[n] and define the maps wi and W2- In 21 we explain how the element 
p G (i? ® i?) ^ may be used to construct certain i^'-algebras. We end 
by outlining each of our three algorithms, assuming in each case the 
existence of a suitable Black Box. 
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Paper II: Geometry. We give further details of the Segre embedding 
method. We represent elements of H^{K, E[n]) by Brauer-Severi dia- 
grams [C — > yS"]. The obstruction in Bt{K) is represented both by the 
Brauer-Severi variety S (of dimension n — 1) and by the obstruction al- 
gebra A (a central simple algebra over K of dimension n^). We specify 
certain embeddings 

SxS"" ^ F{A) 

where is the dual of S. Then starting from p G {R (E) R)^ wc ex- 
plain how to write down both structure constants for A, and equations 
for C as a curve in F{A). If the obstruction is trivial then there are 
isomorphisms S = P'*"^ and A ^ Mat„(i<'). We recover C C P""^ by 
pulling back the image of C in P(Mat„) to P""^ x (P"-^)^ and then 
projecting onto the first factor. 

Paper III: Algorithms. We work over a number field K and assume 
that n is prime. We briefly recall how to compute Se\^^\E/K) first as 
a subgroup of R^ /{R^)"" and then as a subgroup of {R ® R)^ /dR^ . 
Then we give further practical details of our algorithms for converting 
p G {R ® R)^ to C C P"~^, concentrating on the Segre embedding 
method in the case n = 3. Wc also describe the methods wc use for 
the Black Box, including one that is practical in the case i^T = Q and 
n = 3. We illustrate our work with numerical examples. 

1. Interpretations of H^{K,E[n]) 

Let E be an elliptic curve defined over a perfect field K. Wc write 
Gk = GdX{K / K) ^ where K is the algebraic closure of K, and H^{K, — ) 
for the Galois cohomology group (or set) W{Gk-i —)■ Let n > 2 be 
an integer with char(ii') \ n. Taking Galois cohomology of the exact 
sequence 

— > E[n] — >E^E — ^ 

we obtain the Kummer exact sequence 

. . . ^ E{K) H\K, E[n]) ^ H\K,E) ^ .... 

We discuss how to represent elements of these groups. For the group 
on the left this is straight forward: we fix a Weierstrass equation for E 
and specify points in E[K) by writing down their co-ordinates. 

To interpret the other two groups we call upon the general principle 
that the twists of an object X (defined over K) are parametrised by 
H^{K, Aut(X)) where Aut(X) is the automorphism group of X. More 
precisely if Y is another object defined over K, and : F — > X is an 
isomorphism defined over K, then associating to Y the cocycle ^a- — 
a{(l))(l)~^, determines an injective map from the X-isomorphism classes 
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of twists to H^{K, Ant{X)). We claim that in each of our apphcations 
this map is also surjective. Indeed if X is a quasi-projective i^'-variety, 
then the surjectivity follows by Galois descent: see [T3], Chap. V, 
Cor. 2 to Prop. 12. In general X will be a quasi-projective i^-variety 
Xq equipped with certain "additional structure". Thus Aut(X) C 
Aut(Xo). To construct the twist of X by ^ G H^{K, Ant{X)) we first 
take the twist Yq of -^o by ^ and then use the isomorphism 0:10^ 
with a{(j))(j)~^ = ^o- to transfer the additional structure on Xq to Yq. A 
routine calculation shows that the additional structure on is Galois 
invariant, and so defined over K. We recall that if Aut(X) is abelian 
then H^{K, Aut{X)) is an abehan group; otherwise, it is a pointed set 
with the class of X as its distinguished element. 

The prototype example is that of a torsor or principal homogeneous 
space under E. In ^1.41 we will also consider torsors under E[n]. 

Definition 1.1. (i) A torsor under E is a pair {C,fi) where C is a 
smooth projective curve of genus one (defined over K) and ^ : ExC ^ 
C is a morphism (defined over K) that induces a simple transitive 
action on i^'-points. 

(ii) An isomorphism of torsors (Ci,/ii) = (C2,/i2) is an isomorphism of 
curves Ci = C2 that respects the action of E. 

The trivial torsor is {E, +) where + : E x E ^ E is the group law. 

Lemma 1.2. Every torsor under E is a twist of {E, +). 

Proof: More generally we note that if {C,fi) is a torsor under E and 
Po e C(K) then {E, +) = (C, /x) ; P /i(P, Pq) is an isomorphism of 
torsors defined over K{Po). □ 

Lemma 1.3. Aut(E,+) = E. 

Proof: The automorphisms of E, as a torsor under itself, are the au- 
tomorphisms of E, as a curve, that commute with all translation maps. 
The only such automorphisms are the translation maps themselves. □ 

By the twisting principle we obtain 

Proposition 1.4. The torsors under E, viewed as twists of {E,+), 
are parametrised up to isomorphism by H^{K,E). 

With this geometric interpretation, the group {K, E) is called the 
Weil-Chatelet group WC{E/K). 

Remark 1.5. By a standard abuse of notation we refer to a torsor 
as C rather than {C,ii). The only ambiguity in the choice of /i comes 
from the automorphisms of E as an elliptic curve. If j{E) 7^ 0, 1728 
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these are just {±1}, so C will have at most two possible structures of 
torsor under E. The two structures coincide when either one has order 
dividing 2 in H^{K,E). 

We have prepared the following list of interpretations of the group 
H^{K, E[n]). Some are already well known, but others less so. The 
elliptic curve E/K and integer n >2 remain fixed throughout. 



Each of these interpretations appears frequently in our work (except 
for the fourth, which is required only for the flex algebra method). The 
first three interpretations depend on the elliptic curve E in an essential 
way: indeed E may be recovered as the Jacobian of C. The fourth and 
fifth interpretations depend only on E[n] as a Galois module equipped 
with the Weil paring. If n is odd then, by Lemma I3.1H the same is 
true of the sixth interpretation. We now go through each of the six 
interpretations in turn. 

1.1. First interpretation: Torsor divisor class pairs. 

Definition 1.6. (i) A torsor divisor class pair (C, [D]) is a torsor C 
under E together with a i^'-rational divisor class [D] on C of degree n. 
The rationality means that D is linearly equivalent, but not necessarily 
equal, to all its Galois conjugates. 

(ii) An isomorphism of torsor divisor class pairs (Ci, [-Di]) = (C2, [D2]) 
is an isomorphism of torsors : Ci = C2 with (f)*D2 ~ Di. 

The trivial (or base) torsor divisor class pair is {E, [n.O]) where is 
the identity on E. We recall that two divisors on an elliptic curve are 
linearly equivalent if and only if they have the same degree and the 
same sum. 

Lemma 1.7. Every torsor divisor class pair is a twist of {E, [n.O]). 

Proof: Let (C, [D]) be a torsor divisor class pair. We choose an 
isomorphism of torsors (j) : C = E defined over K. We then compose 
with a translation so that 0*(n.O) ~ □ 



1 
2 
3 
4 
5 
6 



Torsor divisor class pairs 
ra-coverings 

Brauer-Severi diagrams 
-E'[n] -torsors 

Comm. extns. of E[n] by G; 
Theta groups 



m 




twisted object 



A 

e. 



[C^S] 



Lemma 1.8. Aut(E, [n.O]) = E[n]. 
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Proof: The automorphisms of ii^ as a torsor under itself are the trans- 
lation maps Tp for P & E. li suffices to note that Tp(n.O) ~ n.O if and 
only \l P e E[n\. □ 

By the twisting principle we obtain 

Proposition 1.9. The torsor divisor class pairs, viewed as twists of 
{E, [n.O]), are parametrised up to isomorphism by H^{K, E[n\). 

Remcirk 1.10. The maps in the Kummer exact sequence 

E{K) ^ H\K,E[n]) ^ H\K,E) 
are given by S{P) = {E, [{n - 1).0 + P]) and l{C, [D]) = C. 
1.2. Second Interpretation: n-coverings. 

Definition 1.11. (i) A covering of £^ is a pair (C, vr) where C is a 
smooth projective curve and n : C ^ E is a non-constant morphism. 
(ii) An isomorphism of coverings (Ci,7ri) = {02,7^2) is an isomorphism 
of curves : Ci = C2 with tti = o 0. 

We write [n] for the multiplication-by-n map on E. The trivial (or 
base) n-covering of E is {E, [n]). 

Definition 1.12. An n-covering (C, tt) is a twist of {E, [n]). 
Lemma 1.13. Aut{E, [n]) ^ E[n]. 

Proof: Let (f) : E ^ E he an automorphism of {E, [n]). Then we 
have [n] — [n] o (p and so [n] o (0 — 1) = 0. We deduce that — 1 is 
not surjective, and therefore constant. It follows that is translation 
by an n-torsion point. □ 

By the twisting principle we obtain 

Proposition 1.14. The n-coverings of E are parametrised up to iso- 
morphism by H^{K, E[n]). 

Remcirk 1.15. Given (C, [D]) a torsor divisor class pair, the corre- 
sponding n-covering is (C, tt) where n : C ^ Pic°(C) = E is the map 
P H- >• [n.P — D]. Conversely, given an n-covering (C, tt) there exists an 
isomorphism (j) : C ^ E defined over K making the diagram 

C 

E—^E 

[n] 
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commute. We give C the structure of torsor under E via 

(P,Q)h.0-1(P + 0(Q)). 

This definition is independent of the choice of 0. The corresponding 
torsor divisor class pair is (C, [0*(n.O)]). The maps in the Kummer 
exact sequence 

E{K) ^ H\K, E[n]) ^ H\K, E) 

are given by 5{P) = {E, Tp o [n]) and l{C, tt) = C. 

1.3. Third interpretation: Brauer-Severi diagrams. 

Definition 1.16. (i) A diagram [C ^ S] is a morphism from a torsor 
C under E to a. variety S. 

(ii) An isomorphism of diagrams [Ci Si] = [C2 S2] is an isomor- 
phism of torsors (p : Ci = C2 together with an isomorphism of varieties 
ip '■ Si = S2 making the diagram 

Ci -^1 

C2 ^ 5*2 

commute. 

The trivial (or base) diagram [E P"^^] is that determined by the 
complete linear system |n.0|. We recall that a twist of projective space 
is called a Brauer-Severi variety. 

Definition 1.17. A Brauer-Severi diagram [C ^ S*] is a twist of [E — > 
P"^^]. In particular S" is a Brauer-Severi variety. 

Lemma 1.18. Ant[E P"-i] ^ E[n]. 

Proof: An automorphism (p of E extends to an automorphism of P""^ 
if and only if (j)*{n.O) ~ n.O. We are done by Lemma fl. 81 □ 

By the twisting principle we obtain 

Proposition 1.19. The Brauer-Severi diagrams are parametrised up 
to isomorphism by H^{K, E[n]) . 

Remark 1.20. Given a torsor divisor class pair (C, [D]) the complete 
linear system \D\ may be identified with the dual of a Brauer-Severi 
variety S. There is then a natural morphism C S. Conversely, given 
a Brauer-Severi diagram [C S] we have S = P"~i over K. We pull 
back the hyperplane section on P"~i to give a /T-rational divisor class 
[D] on C. 
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If n > 3 then the morphism C — > P"^i determined by a complete 
hnear system of degree n is an embedding. The image is called a 
genus one normal curve of degree n. In the case n = 3 we get a 
smooth plane cubic. The homogeneous ideal of a genus one normal 
curve of degree n > 4 is generated by a vector space of quadrics of 
dimension n{n — 3)/2. The term "elliptic normal curve" is standard in 
the geometric literature, the word "normal" referring to the fact that 
the homogeneous co-ordinate ring is integrally closed. We say "genus 
one normal curve" since we do not wish to imply that our curves have 
rational points. 

1.4. Fourth interpretation: E[n\-toYSOYS. 

Definition 1.21. (i) An E[n]-tomoi is a pair ($, /i) where $ is a zero- 
dimensional variety and ^ : E[n\ x $ ^ $ is a morphism that induces 
a simple transitive action on K-points. 

(ii) An isomorphism of i?[n]-torsors = ($2,Ai2) is an isomor- 

phism of varieties $i = $2 that respects the action of E[n]. 

The trivial £'[n]-torsor is -|-) where -|- is the restriction of the 

group law on E. In a manner entirely analogous to the proof of Propo- 
sition ^3 we obtain 

Proposition 1.22. The E[n\-torsors, viewed as twists of {E[n],+), 
are parametrised up to isomorphism by H^{K, E[n]). 

Remark 1.23. (i) Given a torsor divisor class pair (C, [D]) the corre- 
sponding £'[n]-torsor is the set of "flex points", i.e. 

{P eC -.n.P D}. 

(ii) An n-covering tc : C E determines an ii^[r2]-torsor 7r^^(0). 

(iii) The connecting map E{K) H^{K, E[n]) sends P ^ [n]^^{P). 

Remark 1.24. Generically, the splitting field of $ has Galois group the 
afiine general linear group, AGL(2,'n,), which sits in an exact sequence 

^ {Z/nZf AGL(2,n) ^ GL(2,n) ^ 0. 

In the case n = 2 this reduces to the exact sequence — V4 — 6*4 — 
5*3 — > 0, as studied in 

1.5. Fifth Interpretation: Commutative extensions of E[n] by 

Gm- The following definition is common to our fifth and sixth inter- 
pretations of H^{K, E[n]). 
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Definition 1.25. (i) A central extension of E[n\ by Gm is an exact 
sequence of group varieties 

— yG^^A^ E[n] — > 
with Gm contained in tlie centre of A. 

(ii) An isomorphism of central extensions Ai = A2 is an isomorphism 
of group varieties : Ai = A2 making the diagram 

G., — Ai — ^ [n] 

Gn, — A2 — E[n] 

commute. 

We usually refer to A as a central extension, the maps a and f3 being 
taken for granted. The trivial extension is Aq = Gm x E[n\. 

Lemma 1.26. Every commutative extension of E[n] by Gm is a twist 
o/Ao. 

Proof. Since is a divisible group every commutative extension of 
E[n\ by Gm splits over K. □ 

Lemma 1.27. Let A be any central extension of E[n] by Gm- Then 
Aut(A) ^ Hom(E[n],Gm) = E[n]. 

Proof. The automorphisms of A take the form x ^ a{TT{j3{x)))x for 
IT : E[n] Gm a homomorphism. This gives the first isomorphism. 
The second isomorphism comes from the Weil pairing. □ 

By the twisting principle we obtain 

Proposition 1.28. The commutative extensions of E[n] byQ^, viewed 
as twists of Aq, are parametrised up to isomorphism by H^{K, E[n\) . 

This result may be interpreted as giving an isomorphism 

H\K,E[n]) = Ext],{E[n],G^) 

cf. fTU], Example 0.8. 

1.6. Sixth Interpretation: Theta groups. 

Definition 1.29. (i) A theta group is a central extension of E[n] by 

Gm 

— > Gm ^ e ^ E[n] — > 
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with commutator given by the Weil pairing, i.e. 
for all x,y E Q. 

(ii) An isomorphism of theta groups is an isomorphism of central ex- 
tensions (see Definition II. 25j) . 

In ^l.HI we considered the morphism E —>■ P"-~i determined by the 
complete linear system |n.0|. The action of E[n\ on E by translation 
extends to an action on P"-~^ and so determines a map xe '■ E[n\ —>■ 
PGL^. Writing 0^ for the inverse image of XE{E[n]) in GL„ we obtain 
a commutative diagram with exact rows: 

(1) -G^ ^Qe -^M -0 

XE 

*" ^ GL„ *- PGL„ ^ 

It is clear that G^; is a central extension of E[n] by Gm- To show it 
is a theta group, we must show that it has commutator given by the 
Weil pairing. In fact this may be used as the definition of the Weil 
pairing (cf. Lemma I3.13p . For the relationship with the definition 
in Silverman [IB], Chapter III, §8, we refer to Mumford ^T], §§20,23. 
There are issues of choice of sign here which we will ignore. 

Lemma 1.30. Every theta group is a twist o/Qe- 

Proof: More generally we show that any two central extensions of 
E[n] by Gm, with the same commutator pairing, must necessarily be 
isomorphic over K. Let Ai and A2 be two such extensions, and pick a 
basis S, T for E[n]. Since K is a divisible group we may lift S, T to 
elements Si,ti G Ai and ^2,^2 € A2 each of order n. Then there is an 
isomorphism Ai = A2, defined over K, uniquely determined by Si ^ $2 
and ti ^ t2- □ 

By Lemmas 11.271 ll.3(JI and the twisting principle we obtain 

Proposition 1.31. The theta groups for E[n], viewed as twists o/Qe, 
are parametrised up to isomorphism by H^{K, E[n]) . 

Let (C, [D]) be a torsor divisor class pair. We assume for simplicity 
that D is a i^-rational divisor. Then the complete linear system \D\ 
determines a morphism C P"-"^. The action of E[n] on C extends 
to an action on P"~i and so determines a map xc '■ E[n\ ^ PGL„. We 
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obtain a diagram analogous to dH): 

(2) ^Gm -e ^E[n] -0 

xc 

*~ Gm GL„ >■ PGL„ >■ 

We show that this construction of G from (C, [D]) is compatible with 
our first and sixth interpretations of H^{K, E[n]). To do this, let 
{C,[D]) be the twist of {E,[n.O]) by ^ G H\K,E[n]). Then there 
is an isomorphism of Brauer-Severi diagrams defined over K, 



c- 


— ^P" 


-1 










|n.0| 


-1 


E- 


^pn 



with cr(0)0~"'^ = Tg^. We lift to a matrix B G GL„ so that conjugation 
by B defines an isomorphism \l/ : = 0^;. It is evident that = 
a{B)B~^ is an element of 0£; projecting onto C,cr- Therefore 

cr(^f)^~i : ^ Oij ; x ^^ VaXy'^ = e„(^^, x)x 

and is the twist of 0^ by ^ as was to be shown. 

In fact there is a more direct way to construct from {C, [D] ) . We 
write Tp : C C ; Q ^ /^(-Pj Q) for the action of P G -E on C. 

Proposition 1.32. Let {C, [D]) be a torsor divisor class pair with D 
a K -rational divisor. Then the corresponding theta group is 

= { (/, T) G K{CY X E[n] \ div(/) = t*tD-D] 

with group law 

(3) (/i,Ti) * (/2,T2) = (r*^(/i)/2,Ti +T2) 

and structure maps a : A ^— > (A, 0) and (3 : {f ,T) ^ T . 
Proof: The complete linear system \D\ determines a morphism 

C ¥{C{D)*) ^ P"-i 
where C{D) is the Riemann-Roch space 

C{D) = {/ G K{CY I div(/) + D > 0} U {0}. 
Let t : ^ End(/:(L')*) be given by 

.(/,T)(x) = (/i^x(/r*/i)) 
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for all X G C{D)* and h G C{D). It may be verified that the diagram 

C — -p(/:p)*) 

t(/,T) 

C ^¥{C{DY) 

commutes. The group law on B is then that required to make i a group 
homomorphism. □ 

2. The obstruction map 

We continue to take E an elliptic curve over K and n > 2 an integer. 
We recall from ^1.11 that H^{K^E[n\) parametrises the torsor divisor 
class pairs (C, [D]). Here [D] is a i^-rational divisor class on C. 

For any smooth projective variety X over K there is an exact se- 
quence of Galois modules 

^ K{XY Div(X) Pic(X) 0. 

Splitting into short exact sequences and taking Galois cohomology we 
obtain an exact sequence (see for details) 

(4) ^ K{XY Div(X)^^ ^ Pic(X)^^ ^ Bi{K). 

We define the obstruction map 

Ob : H\K, E[n]) ^ Bi{K) ; (C, [D]) ^ SdlD])- 

Prom (jH) we obtain the fundamental property of the obstruction map, 
namely that D is linearly equivalent to a i^-rational divisor if and only 
if Ob(C, [D]) = 0. We also have 

Lemma 2.1. Let {C, [D]) be a torsor divisor class pair. If C{K) ^ 
(eqmvalently C = E overK) then Ob(C, [D]) = 0. 

Proof. Let P G C{K). By Riemann-Roch D — {n — 1)P is linearly 
equivalent to a unique point Q E C. The uniqueness statement proves 
that Q is /^-rational. So D ~ {n — l)P + Q and the latter is i^'-rational. 
It follows that Ob(C, [D]) = 0. Alternatively the lemma follows from 
Remark irnH □ 

We give an alternative description of the obstruction map. The base 
theta group 9^; was defined in ^1.61 

Proposition 2.2. The obstruction map 

Ob : H\K,E[n]) H\K,GJ 
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is obtained as the connecting map of (non-ahelian) Galois cohomology 
for the exact sequence 

^ 0^5 ^ E[n] 0. 

Proof. The proof is by means of a cocycle calculation. We start with 
a torsor divisor class pair {C,[D]). Since [D] is a i^-rational divisor 
class, there exist rational functions /ig- G K(C)^ with div{h„) = aD—D 
for all a G Gk- By definition of the obstruction map, Ob(C, [D]) is 
represented by the cocycle 

(5) ((T,r)^— . 

Let i e H\K,E[n]) describe {G,[D]) as a twist of {E,[n.O]). This 
means there is an isomorphism of torsors (p : G = E, defined over K, 
with 0*(n.O) = D and a{(f))(f)~^ = t^^. We recall that G^; is the theta 
group determined by {E, [n.O]). By Proposition II .^21 we identify 

9^ = {(/,T) X E[n] I div(/) = r*M)-n.O}. 

We lift G E[n] to a pair (/^, G O^;. Then 

div(07<,) = 0*r|^(n.O) -0*(n.O) 
= ((T0f*(n.O) -0*(n.O) 
= (xD-D. 

Taking h^j = (p* fa in (0) we obtain 

where * is the group law Q- We recognise this final expression as the 
connecting map of Galois cohomology. □ 

Remark 2.3. We may identify ker(Ob) = H^{K,Qe)- 

It is well known that taking Galois cohomology of the exact sequence 

^ Gin ^ GL„ ^ PGL„ ^ 

gives an injection 

A : H^{K,VGLn) ^ Br {K)[n]. 
This leads to our third interpretation of the obstruction map. 
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Lemma 2.4. Let [E P"~^] be the base Brauer-Severi diagram and 
let xe '■ E[n] PGL„ describe the action of E[n] on E. Then the 
obstruction map is 

Xe,* : H\K,E[n]) ^ H\K,PGK). 

Proof: (Taken from fBl-) Taking Galois cohomology in we obtain 
a commutative diagram 

H\K,E[n]) ^H\K,GJ 

XE,* 

The lemma follows from the description of the obstruction map given 
in Proposition 12.21 □ 

Finally we interpret the obstruction map as a forgetful map. 

Corollary 2.5. The obstruction map Ob : H^{K, E[n]) Br(i^') 
sends [C S] to S. 

Proof: Let [C S] be the twist of [E P"-i] by ^ G H\K, E[n]). 
Then there is an isomorphism of Brauer-Severi diagrams defined over K 



c — 


















E — 




-1 



with a{(l))(l) = T^a- It follows that o'{ip)4' ^ = XEiCa) and so 5" is the 
twist of P"-i by Ob(0 = XeAO e H\K, PGL„). □ 

If [C — s> S*] is a Brauer-Severi diagram with C{K) ^ then clearly 
SiK^ 7^ 0. So Corollarv 12.51 gives an alternative proof of Lemma f2. II 

Remark 2.6. In general the obstruction map is not a group homo- 
morphism. But, as shown in [THj, it is quadratic in the sense that 

(i) Ob(a^) = Ob(^) for a an integer, and 

(ii) {i, T]) ^ Ob(^ + V) - Ob(^) - Ob(r7) is bilinear. 

3. The etale algebra 

Let R be the afiine co-ordinate algebra of E[n]. It consists of all 
Galois equivariant maps from E[n] to K. In symbols 

R = MapK{E[n\,K). 
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For example, any rational function on E defined over K and not having 
poles in E[n\ will give an element of R. Since E[n] is an etale K- 
scheme, R is an etalc algebra: it is isomorphic to a product of (finite) 
field extensions of K, one for each Gi^-orbit in E[n]. If T is a point 
in one such orbit, then the corresponding field extension is K{T). If 
n is prime then typically we have R — K x L where L/K is a field 
extension of degree — 1. 
We also work with the algebra 

R^ R(^kK ^Meip{E[n\,K). 

Note that the action of cr e Gk is a ^— > {cr{a) : T a{a{a~^T))). As 
a vector space R has basis the St for T e E[n] where 



1 if S = T, 
otherwise. 



In general, if Ra and Rb are the coordinate rings of two affine K- 
schemes A and B, then Ra ®k Rb is the coordinate ring of A x B. 
So R ®K R is the algebra of Galois equivariant maps from E[n\ x E[n\ 
into K, and R®j^R — {R®k R) ®k K is the algebra of all such maps. 

The Weil pairing : E[n\ x E[n\ — > determines an injection 

w : E[n] ^R""^ Map(£;[n], F"") 

via w{S){T) = en{S,T). We observe that the w(T), for T e E[n], are 

not only maps, but also homomorphisms E[n] K . By the non- 
degeneracy of the Weil pairing, all such homomorphisms arise in this 
way. So if we define d : R ^{R^^R^ via 



a(Ti + T2)' 



(6) (5a)(Ti,T2: 

then there is an exact sequence 

(7) O^E[n]^R'' ^(R^R)''. 

By a generalised version of Hilbert's theorem 90 (which reduces by 
Shapiro's lemma to the usual version of Hilbert's theorem 90 applied 
to each constituent field of R) we have 

H\K,R'')^0. 
We use these observations to define group homomorphisms 
wi : H\K, E[n]) ^ R"" /{R'')'' 

and 

W2 : H\K,E[n\) (i? ® 
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It is convenient to give both definitions at once. We start with ^ G 
H^{K, E[n\) and use Hilbert's theorem 90 to write wl^^) = cr{'~f)/'~f for 

some 7 G . Then a = 7" and p = d'y are Galois invariant and so 
belong to and {R® R)^ respectively. We define wi(^) = a(-R^)" 
and ^2(0 = pdR^. If we change ^ by a coboundary, say cr(T) — T, 
then 7 is multiplied by w(T). Since w{TY = 1 and d{w(T)) = 1 this 
leaves the values of a and p unchanged. The only remaining freedom is 
to multiply 7 by an element of R^ . This has the effect of multiplying 
a and p by elements of (i?^)" and dR^ respectively. It follows that Wi 
and W2 are well defined. 

The map wi is in fact the composite 

H\K,E[n]) H\K,p^iR)) ^ R^ /{R^Y 
where if* is induced by and k is the Kummer isomorphism. 
Lemma 3.1. If n is prime then Wi is injective. 

Proof: See Proposition 7, or [14J, Corollary 5.1. □ 

In general wi is not injective. For example, taking n = 4 and E/Q 
the elliptic curve y'^ = + x + 2/13, it may be shown that Wi has 
kernel of order 2. 

Lemma 3.2. The map W2 is injective. 

Proof: Let ^ belong to the kernel of W2. Then w(^o-) = 0"(7)/7 for 
some 7 G R^ . Multiplying 7 by an element of R^ we may suppose 
that d'j = 1. Then ((7j) gives 7 = u'(T) for some T G -E[?t,]. Since w is 
injective it follows that C,a = <^{T) — T. Hence ^ is a coboundary. □ 

In ^1.51 we showed that H^{K,E[n]) parametrises the commutative 
extensions of E[n\ by Gm- This point of view will help us determine 
the image of W2- By Hilbert's theorem 90 every central extension 

^ ^ A ^ E[n] 

has a Galois equivariant section cf) : E[n] K. In general is not a 
group homomorphism. The possible choices of differ by elements of 

Ma.^ j^{E[n],K'') = 

We define the first and second invariants of A. The first invariant is 
invi(A) = q;(-R^)" where a G R^ satisfies 

(8) 0(T)" = a{T) 

for all T G E[n\. The second invariant is inv2(A) = pdR^ where 
p G {R® R)^ satisfies 

(9) 0(Ti)0(T2) =p(Ti,T2)0(ri+T2). 
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for all Ti,T2 G E[n]. Notice that invi(A) and inv2(A) depend only on 
A and not on the choice of section 0. 

Lemma 3.3. Let A be the twist of Aq by ^ e H'^{K,E[n\). Then 
invi(A) = wi{C,) and inv2(A) = tf2(0- 

Proof: By hypothesis there is a commutative diagram 

^ ^ A ^ E[n\ ^ 

^ ^ Ao ^ E[n] ^ 

with a{tp)ilj~^ : x i— > e„(^o-, a;)a;. We use Hilbert's theorem 90 to write 

w(^o-) = (^{l)h some 7 G . Let 0o : E[n] ^ Aq be the natural 
section for Aq. A calculation reveals that 

<P:E[n]-.A- T^^{T)r\MT)) 

is a Galois equivariant section for A. So by (jSI) and Q we have = 7"' 
and p = d'j as required. □ 

Remark 3.4. It is clear that a central extension of E[n] by Gm is 
uniquely determined up to isomorphism by its second invariant. Thus 
Lemma 13.31 gives an alternative proof of Lemma | 

We extend ((Tj) to a complex 

E[n] ^ F - 
where the second d is given by 



O^E[n] ^i?^ {R^Ry ^{R0R0Ry 



1- p(7'i,T2)p(Ti +T2,T3) 



p(Ti,T2 + T3)p(T2,T3)- 

For each p G (R^R)^ we write p°P for the element obtained by switch- 
ing the operands, i.e. p°^(Ti,T2) = p(T2,Ti). 

Lemma 3.5. The image of W2 is 

H = {pe{R®RY \p = p""" and dp = 1} /OR''. 

Proof: The conditions p = p°P and dp = 1 express the fact that A is 
commutative and associative. Conversely, if pdR^ G H then we define 
a new multiplication on x E[n] via 

(Ai,Ti) * (A2,T2) = (AiA2p(Ti,T2),Ti + T2). 

This gives the required commutative extension of E[n\ by G^. □ 

Corollary 3.6. If pdR^ G H then p = for some 7 G R^ . 
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Proof: This is the case K = K oi the last lemma. □ 



Remark 3.7. Lemma (3.51 mav equally be deduced from Corollary 
by taking Galois cohomology of the short exact sequence 

E[n] 7?^ ^ ker(a| Sym2(i?)x) 

where Sym^(^) = [p e^®^ \ p = p°P}. 

In applications we take K a number field and n a prime. As explained 
in the introduction, we compute Sel(")(£;/X) first subgroup of 
/{K^Y aiid then convert it to a subgroup of if C {R® R)^/dR^. 
To make this conversion, we let n be the map making the diagram 



W2 



H ^R''/{R''Y 

commute. If pdR^ G H then by Corollary 13.61 we have p = d'j for 
some 7 G -R . Tracing through the definitions we find that n{pdR^) = 
a{R'^Y where a = 7" G -R^. 

Lemma 3.8. Let a{R^Y belong to the image ofwi. Then there exists 
p G Sym2(i?)x with (i) da = p", (ii) a{T) = U7=o PiT,iT) for all 
T G E[n], and (Hi) dp = 1. Moreover if p E Sym^(i?)^ satisfies (ii) 
and (Hi) then K{pdR^) = a{R^Y . 

Proof: Since Wi = k o W2 there exists pdR^ G H with n^pdR^) = 
a{R^Y. Corollarv 13.61 gives p = d'j for some 7 G R^ . Multiplying 7 
by a suitable element of R^ we may suppose that 7" = a. Conditions 
(i), (ii) and (iii) follow at once. 

Conversely if p G Sym^(i?)^ satisfies (ii) and (iii) then pdR^ G H 
and so p = d'j for some 7 G R^ . By (ii) we deduce a = 7". □ 

Remark 3.9. If Sym^(i?) contains no non-trivial nth roots of unity, 
then we construct p from a by taking the unique nth root of da. There 
is no need to check conditions (ii) and (iii). 

We have identified H^{K, E[n]) with a subgroup H C (R^R)^ /dR^ . 
We did this using commutative extensions of E[n] by G^. But we may 
equally work with theta groups (cf. ^1.6|) . 

Lemma 3.10. Let be the tivist of Qe by ^ E H'^{K,E[n\). Then 
invi(6) = Wi(^) invi(9£;) and inv2(0) = ^2(0 (©£;)■ 
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Proof: The proof is similar to that of Lemma fH. HI □ 

Let e E {R® R)^ with mv2{QE) = sdR^ . Then the theta groups 
for E[n], or rather their second invariants, make up the coset 

eH = {pE{R®RY \ p(p°P)"^ = e and dp = Ij/dR"" 

where e G fin{R® R) is the Weil pairing. We discuss several ways of 
computing e. Our first method uses the definition of 6^; as a subgroup 
of GL„. Recall that we mapped E —>■ P"^i via |?t,.0|. Let M be a 
matrix in 

GK{R) = Map^(EM,GL„(Z)) 

that describes the action of E[n\ on P"~^. Then G^; has Galois equi- 
variant section T ^-^ Mt and so e G (i? ® -R) ^ is determined by 

Mt.Mt, = e{Ti,T2)MT,+T,. 

Our second method uses the description of G^; obtained by taking 
(C, [D]) = {E, [n.O]) in Proposition 11.321 Let F be a rational function 
in 

R{Ey = MapK{E[n],K{Ey) 

with div(Fj') = n.T — n.O. Then G^ has Galois-equivariant section 
T 1-^ {Et, —T)^^. Using the group law Q we obtain 

EtAP)Ft,{P-T,) 
where the righthand side is constant as a function of P E E. 
If n is odd then we are spared the above calculations. 

Lemma 3.11. If n is odd, say n = 2m — 1, then invi(G£;) is trivial 
and inv2(G£;) = e'^dR^ . In particular Qe depends on E[n] and the 
Weil pairing, but not on E. 

Proof: As before we map E — > P"^i via |n.0|. The action of E[n] on 
E determines xe '■ E[n] — » PGL„. Likewise the negation map [—1] on 
E determines an element l G PGL„. We claim that for each torsion 
point T E E[n] there is a unique lift Mt of xiT) to GL„ such that (i) 
lMtl~^ = M^^ and (ii) = I. Indeed the first condition determines 
Mt up to sign, and implies M^ = ±1. Then, since n is odd, the second 
condition determines a unique choice of this sign. 

The uniqueness statement tells us that the map : T i— Mt is Galois 
equivariant. A short calculation (using (i), (ii) and the commutator 
condition) reveals that MsMt = en{S,T)"'Ms+T for all S,T E E[n]. 
Substituting in (jH} and Q we get a = 1 and p = e*" as required. □ 
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If n is odd then the restriction of wi to the kernel of the obstruction 
map has the following alternative interpretation. 

Corollary 3.12. Assume n is odd. Let [C P"^^] be the Brauer- 
Severi diagram determined hy ^ & H'^{K.,E[n\) and let M G GL„(i?) 
describe the action of E\n] on C. Then wi{S,) = (det M)(i?^)". 

PROOF: Let 6 be the theta group determined by [C P""^]. Then 
e is the twist of 6^ by ^ G H^{K,E[n]). By Lemmas EUDl and EZU 
we have invi(6) = wi(^). Therefore wi(^) = where a G is 

determined by M" = a/„. The next lemma shows that if T G E[n] has 
order r then Mt has characteristic polynomial of the form (X^' — c)"/''. 
We deduce that det(M) = a as required. □ 

In the following lemma we assume that K is algebraically closed, and 
fix (n ^ K a primitive nth root of unity. 

Lemma 3.13. Let C C P"^^ be a genus one normal curve with Jaco- 
bian E. Let Ti, T2 be a basis for E[n] with e„(Ti,T2) = C^. Then we 
can choose co-ordinates on P*^"! so that Ti, T2 act on C via 





/I 





•■ 








■■ 


■ 


1\ 







Cn 


■■ 







1 


■■ 


■ 





Ml = 


















1 ■ ■ 


■ 







\o 





■■ 


■ crv 




Vo 


■■ 


■ 1 


0/ 



Proof: This is quite standard. See for example ^21- ^ 

4. From extensions to enveloping algebras 

4.1. Enveloping algebras. We consider i^'-algebras A that are finite 
dimensional over K. The unit group of A = A ®k K may be viewed 
as (the iiT-rational points of) a iiT-group variety. For instance, if A is 
the matrix algebra Mat„(-ft') then this construction yields GL„. 

Definition 4.1. Let A be a central extension of E[n\ by Gm- Let A be 

a i^-algebra with [A : K] = n"^. An embedding of A in A is a morphism 

of K-group varieties l : A ^ A^ such that 

(i) t preserves scalars, i.e. l{X) = A for all A G -fT , 

(ii) the image of t spans A as a if-vector space. 

Lemma 4.2. Every central extension of E[n] by Gm embeds in a K- 
algebra. 
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Proof: Let : E[n] — A be a Galois equivariant section for A. As 
in ^we write R for the etale algebra of E[n\ and recall that i? is a 
i^'- vector space with basis the 5t for T G E[n]. We define a Galois 
equivariant inclusion of A in i? via 

A0(r) ^ \5t 

for all A G JsT and T G E[n]. The group law on A extends uniquely 
to a new i^'-algebra multiplication on R, which in turn descends to a 
ii"-algebra multiplication 

*:RyiR^R. 

Thus A embeds in the i^-algebra A = {R, +,*). □ 

Lemma 4.3. Let Ai and A2 be central extensions of E[n\ by Gm em- 
bedding in K -algebras Ai and Ai- Then every isomorphism of central 
extensions ip : Ki = K2 extends uniquely to an isomorphism of K- 
algebras : Ai = A2. 

Proof: We construct \E' from ip by extending linearly to an isomor- 
phism of -ft^-algebras, and then restricting to /T-algebras. Condition 
(ii) of Definition 14. II ensures that ^ is unique. □ 

Definition 4.4. Let A be a central extension of E[n\ by Gm- If A 
embeds in a i^'-algebra A then A is the enveloping algebra of A. 

We have shown that enveloping algebras exist and are unique up to 
isomorphism. Next we outline a method for computing them. The 
addition law 

E[n] X E[n] E[n] 
gives rise to the comultiplication 

/\: R^ R®R 

with A(a)(Ti, T2) = a(Ti + T2). Viewing (g) i? as an i?-algebra via A 
there is a trace map 

It : R® R^ R. 
In terms of functions it is given by 

(10) Tr(p)(T)= 

Ti+T2=T 

It may also be built out of the trace maps for the constituent fields of 
R®R and R. 
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Lemma 4.5. Let A be a central extension of E[n] by Gm- //'inv2(A) = 
pdR^ then A has enveloping algebra {R,+,*p) where 

zi *p Z2 = Tr{p.zi (g) Z2). 

Proof: By hypothesis there exists T h-* 4'{T) a Galois equivariant 
section for A —>■ E[n\ with 

0(ri)0(T2) = p(Ti, r2)0(Ti + T2). 

Following the proof of Lemma 14.21 we obtain 

Ss *p St = pis, T)Ss+T- 
We write this multiplication in a form that descends to K: 

Zl *p Z2 = (Et ZliT)6T) *p (Et Z2{T)6t) 

= Y.t{T.t^+T2=tP{Ti,T2)zi{Ti)z2{T2))5t 
= Tr{p.zi0Z2). 

□ 

Lemma 14.31 tells us that if Ai and A2 are isomorphic (as central 
extensions) then Ai and A2 are isomorphic (as i^"-algebras) . More 
concretely we have 

Lemma 4.6. Let Ai = {R, +, *pj and A2 = {R, +, *p2) envelop- 
ing algebras determined by pi,p2 ^ (-R ® -R)^ with dpi = dp2 = 1. // 
Pi = P2dl for some 7 G R^ then there is an isomorphism of K -algebras 

Ai^ A2] z^ -f.z 

where the multiplication is that in R. 

Proof: We compute 

1-{ZI *pi Z2) = (T 7(T) Y.T^+T2=T PliTl,T2)zi{Ti)Z2{T2)) 

= {T^ ET,+T,=Tp2iTi,T2h{T^)z,{TMT2)z2{T2)) 

= (7-2:1) *P2 (7-2:2) 

□ 

4.2. The flex algebra. Let $ be an i?[n]-torsor and let F be the etale 
algebra of $, i.e. 

F = Map;^($,Z). 

Since E[n] acts on $ it also acts on = Map($, K^). The "eigen- 
vectors" for this action form a group 

there exists T & E[n] such that 
z{S + P) = en{S,T)z{P) 
for all S e E[n] and P G $ 



A = izeF"" 
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Thus we obtain a commutative extension 

— ^Gm-^A^ E[n] — > 

where in the above notation f3{z) = T. We show that this construction 
of A from F is compatible with our fourth and fifth interpretations of 
H^{K, E[n]). To do this let $ be the twist of E[n] by ^ G H^{K, E[n]). 
This means there is an isomorphism of £'[n]-torsors ip : $ E[n], 
defined over K, with a{tp)ilj~'^ = r^^. We define 

^* ■.F = Map{^,K) ^Map{E[n],K) = R 

via 'ip*{z){P) = z{tlj^^{P)). Then ip* restricts to an isomorphism of 
central extensions 7 : A = Aq where 

Ao = X E[n] = { Xw{T) e ^R"" | A G Z^ T e E[n] }. 
We find 

cr(7)7"^ : Ao Ao ; x ^ e„(^^,x)x. 

So A is the twist of Aq by ^ as was to be shown. We summarise the 
above discussion in 

Proposition 4.7. The enveloping algebra of a commutative extension 
of E[n] by Gm is the etale algebra of the corresponding E[n]-torsor. 

If ^ G H\K,E[n]) with W2{0 = pdK^ then by Lemmas l!0 and 1131 
the flex algebra is (i?, +, *p). Taking p = 1 should give the etale algebra 
of E[n]. We recognise (i?, as the group algebra of E[n]. It is 
isomorphic to R via the Fourier transform a ^ a where 

a{S) = ^y^e^{S,T)a{T). 

T 

4.3. The obstruction algebra. 

Lemma 4.8. The base theta group Qe embeds in Mat„(i^r). In partic- 
ular Qe spans Mat„(-ft') as a K -vector space. 

Proof: We recall that 9^; was defined in ^1.61 as a subgroup of GLn- 
Let T \—>- Mjn be a section for O^; — > E[n]. By Definition II .291 we have 

MsMtMs^M^^ = en{S,T) 

for all S,T G E[n]. From the non-degeneracy of the Weil pairing it fol- 
lows that the Mt are linearly independent over K. A dimension count 
shows that they span Mat„(i^'). This proves the second statement of 
the lemma. The first now follows by Definition 14.11 □ 
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Lemma 4.9. If Q is a theta group for E[n] with enveloping algebra A 
then A is a central simple K -algebra with [A : K] = n'^. In particular 
O spans A as a K-vector space. 

Proof: We saw in Lemma fl .301 that G is a twist of 0^;. It follows by 
Lemma [4.31 that A is a twist of Ma.tn{K). □ 

We use Definition 14.11 and Lemma 14.91 to build a commutative dia- 
gram with exact rows 

(11) — -G,n — -e -^N -0 



a"" Aut(A) 0. 

The second row is exact by the Noether-Skolem theorem. The right- 
hand vertical arrow is the composite of E[n\ = Aut(G), cf. Lemma ri.27l 
and Aut(6) Aut(y4), cf. Lemma HTHl We recognise (jlj and as 
special cases of this new diagram. 

Proposition 4.10. If Q is a theta group for E[n] with enveloping 
algebra A then the obstruction map sends the class ofQ in H^{K, E[n]) 
to the class of A in Bt{K). 

Proof. Let 9^; be the base theta group, i.e. the theta group associated 
to {E, [n.O]). Let xe '■ E[n] PGL„ be the right-hand vertical arrow 
in (0). According to Proposition 12.41 the obstruction map is 

XE,* : H\K,E[n]) ^ H\K,FGLn). 

Now let G be the twist of G^; by ^ G H^{K, E[n\). This means there 
is an isomorphism of theta groups 7 : G = G^;, defined over K, with 

a(7)7~^ : x e„(^<^,x)a; 

for all X & Qe- It follows from the commutator condition that o"(7)7~^ 
is conjugation by any lift of to G^;. Then Lemma 11751 tells us that 
7 extends to an isomorphism T : A = Mat(n, i^'). So cr(r)r^^ is 
conjugation by any lift of Xsi^a) to GL„(fr). It follows that Xe,*{0 
represents the class of A in H^{K, PGL„). □ 

The following variant on the above terminology is often helpful. 

Definition 4.11. Let G be a theta group for E[n]. As a special case 
of Definition 14.11 we define a representation of G to be an embedding 
of G in the matrix algebra Mat„(i^r). In other words, a representation 
is a morphism of group varieties G GL„ that preserves scalars. We 
recognise diagrams (H)) and © as representations of theta groups. 
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5. Recovering explicit equations 

Given p G {R®R)^ representing an element pdR^ ^ H = H^{K, E[n]) 
with trivial obstruction, we aim to find equations for the corresponding 
Brauer-Severi diagram [C P"^^]. We present three algorithms for 
performing this conversion, assuming in each case the existence of a 
"Black Box" to trivialise the obstruction algebra. We assume for ease 
of exposition that n > 3. 

We fix a basis ri, . . . , r„2 for i? as a 7^- vector space. Let rjj', . . . , r*2 
be the dual basis with respect to the trace form 

(r,s) ^ tr/j/i^(rs) = ^yg^[„]r(T)s(r). 

A useful technique, used in several proofs, is reduction to the "geomet- 
ric case". By this we mean taking K = K and rj = r* = where 
E[n] = {Ti, . . . , T„2}. The following lemma is typical. 



Lemma 5.1. Let 6 = Yli=i r* i^riE R. Then 
6iS,T) = 



1 zfS = T, 
otherwise. 

Proof: We first note that 6 does not depend on the choice of basis 
ri, . . . , r„2. The lemma follows by reduction to the geometric case. □ 



5.1. The Hesse pencil method. We start with the Hesse pencil 
method, since it is the simplest of our three methods both to explain 
and to implement. 

Proposition 5.2. Let 6 be the twist o/Qe by ^ e H^{K,E[n]). 

(i) The theta group G has a representation 

(12) — -G^ -e -^M — -0 

X 

*~ Gm GL„ PGL„ 

if and only if Ob(^) = 0. 

(a) If Q has a representation H^) then there is a unique genus one 
normal curve C C P""^ with Jacobian E for which the action of each 
T e E[n] on C is given by x{T)- Moreover [C P""^] is the Brauer- 
Severi diagram determined by ^. 

Proof: (i) This is a special case of Proposition 14. lUl 

(ii) Let [C — > P"~^] be the Brauer-Severi diagram determined by ^. We 
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recall from §l.fil that B has a representation 

(13) — -G^ -e -^N — -0 

xc 

^ Gm ^ GL„ ^ PGL„ 

According to Lemma f4.3| the representations ()12|1 and (fT!?|l differ only 
by an automorphism of Mat„(fr). By the Noether-Skolem theorem this 
automorphism is conjugation by an element of GL„(ir). So making a 
change of co-ordinates on P"~i we may arrange that x = Xc- 

The proof of Lemma lTTTI shows that if C, C C P""^ are genus one nor- 
mal curves with the same j-invariant, then there exists a G PGL„(i^') 
with a{C) = C. Moreover, using Lemma f3. 131 one can show that the 
image of xc is its own centraliser in PGL„. The uniqueness statement 
follows. □ 

We describe the Hesse pencil method in greater detail. 

Proposition 5.3. Let ^ G H'^{K,E[n]) and p G {R(g)Ry withw2{i) = 
pdR^. Let Ap = {R,+,*sp) where inv2(0£;) = edR^. Then 

(i) Ob(0 = z/ and only if Ap = Mat„(K). 

(ii) If T : Ap = Mat„(-ft') is an isomorphism of K- algebras and 

M = E£i^^(^0 e GK{R) = Map^{E[n],GK(K)) 

then there is a unique genus one normal curve C C P"^^ with Jacobian 
E for which the action of each T E E[n] on C is given by Mt- Moreover 
[C P"~-^] is the Brauer-Severi diagram determined by ^. 

Proof: (i) Let 9 be the twist of 6^; by ^. By Lemma 13. lUI we have 
inv2(0) = epdR^. Then Lemma 14.51 identifies Ap as the enveloping 
algebra of G. We are done by Proposition 14. lUl 

(ii) Since inv2(6) = epdR^ there exists a Galois equivariant section 
: E[n] e with 

0(5)0(T) = £(5,T)p(5,T)0(5 + T) 

for all S,T & E[n\. We claim that 0(T) i— > Mt extends to a represen- 
tation of 0. It suffices to check this in the geometric case, whereupon 
Mt = t{6t)- The proof of Lemma (4.51 shows that 0(T) ^-^ 6t extends 
to an embedding of 6 in Ap. Since r is an isomorphism of i^'-algebras, 
it follows that B embeds in Mat„(i^) as claimed. 

Finally we apply Proposition I5.2r ii) with x{T) = [Mt]- □ 
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Remark 5.4. We may take any convenient choice for e. For example 
we saw in Lemma 13.111 that if n is odd then a convenient choice is the 
square root of the Weil pairing. 

It remains to recover equations for C C P"^^ from M G GL„(i?). 

Proposition 5.5. Assume n > 3 and let M G GL„(i?) such that 

(i) E[n] PGL„ ; T [Mt\ is a group homomorphism, and 

(ii) MsMtMs^M^^ = en{S,T)In for all S,T e E[n]. 

Then the genus one normal curves C C P'*"^ for which each matrix 
acts as translation by some n-torsion point o/ Jac(C), are parametrised 
by (a twist of) the modular curve Y{n). Moreover the number of curves 
in this family that are defined over K and have Jacobian E is 

VE,n = [Aut;^(^[n]) : Aut k{E)] 

where Aut K{E[n]) is the group of K -rational automorphisms of E[n] 
that respect the Weil pairing. 

Proof: The first statement is a geometric one. For its proof we may 
fix a basis S,T for E[n] and assume that Ms and Mt are the stan- 
dard matrices Mi and M2 specified in Lemma 13.131 We recall that 
Y{n) parametrises the triples {E',S',T') where E' is an elliptic curve 
and S',T' are a basis for E'[n] with e„(5",T') = (n- Lemma Hi. 131 fur- 
nishes us with a bijection between the triples {E', S', T') and the genus 
one normal curves C C P"~^ considered here. So the latter are also 
parametrised by Y{n). 

Proposition I5.2r ii) establishes the existence of a genus one normal 
curve C C P"-"^ with Jacobian E for which the action of each T E E[n] 
is given by Mt- Let C be another curve in the Y{n) family, defined 
over K and with Jac(C") = E. Then each T G E[n\ acts on C via 
Ma{T) for some a G Aut K{E[n]). Changing our choice of isomorphism 
Jac(C") = E changes a by an element of AutxiE). Here we use our 
assumption ri > 3 to identify Aut k{E) as a subgroup of Aut K{E[n]). 
It follows by Proposition Em^ii) that the curves C considered here are 
in bijection with the quotient group Autx {E[n])/ AutxiE). □ 

In general we have ue^u < 7^ PSL2(Z/riZ). We now specialise to the 
case n = 3. 

Lemma 5.6. Let M G GL3(i?) as in Proposition \5.^ Let {x : y : z) 

be co-ordinates on P^ and put 



M U L \v"\ = M 
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Then the family of curves parametrised by Y{3) is (an open subset of) 
the pencil of plane cubics spanned by the Fi{x,y,z) G K[x,y,z] where 

9 
i=l 

Proof: Let 5, T be a basis for E[n]. For the proof we may assume 
that Ms and Mr are the standard matrices Mi and M2 specified in 
Lemma f3. 131 In this case our construction does indeed give the pencil 
of plane cubics spanned by + y'^ + and xyz. □ 

We use the classical invariants of a ternary cubic (cf. [T) to pick out 
those members of the pencil that are defined over K and have Jacobian 
E. In practice this means finding the /^-rational roots of a polynomial 
of degree 12. According to Proposition 15.51 we are left with a list of 
ve,z candidates for C C P^. In favourable circumstances (including the 
case i^' = Q) we can show ve,z = 1- 

Lemma 5.7. Assume that either (i) pE;3 '■ Gk —>■ GL2(Z/3Z) is sur- 
jective, or (ii) K is a number field with a real place. Then ue^s = 1- 

Proof: Let G C GL2(Z/3Z) be the image of pe,3. Then 

(14) Autx(^[3]) = {xe SL2(Z/3Z) \ xy = yx for all y G G}. 

(i) We find Auti^(E[3]) = {±1} and so ue,3 = 1- 

(ii) Since ^ K it is clear that G contains an element of determinant 
— 1. But there are only 3 such conjugacy classes in GL2(Z/3Z). Hence 
we may assume that G contains either ±a or b where 

and 6= (J \y 

It follows by (HH) that Auti^(E[3]) = {±1} or {±1, ia^}. If the latter, 
then a further application of ()14|) shows that G is cyclic of order 8. 
By considering the subfields of K{E[3]) we are led to the contradiction 
K{y/^) C K{E[3]) n M. Hence Aut^(E[3]) = {±1} and ue,3 = 1 as 
claimed. □ 

In jS] a formula based on Corollary 13.121 is used to recover a G 
/{R^)^ from a ternary cubic. The Hesse pencil method is completed 
in the case ue^s > 1 by applying this formula to each of the (at most 
12) candidate ternary cubics, and seeing which gives rise to the correct 
element a G R^ /{R^)^. 



X x' x" 

y y' y" 



z z 



z 
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5.2. The flex algebra method. This method has the advantage over 
the Hesse pencil method that it works for all n > 2. For ease of 
exposition we continue to assume that n > 3. 

We embed E p"--i via the complete linear system |n.0| and com- 
pute M G GL„(i?) = Ma.pj^{E[n],GLn{K)) describing the action of 
E[n] on E by translation. We also compute e G (i? ® i?)^ with 
MsMt = e{S,T)Ms+T for all S,T e E[n]. 

Proposition 5.8. Let ^ G H^{K, E[n]) and p G {R^R)'' with W2{0 = 
p OR"" . Let Ai = {R,+, *e) and Ap = (/?,+, *ep) ■ 
(i) There exists 7 G R^ with d'j = p, and so an isomorphism of K- 
algebras .7 : — Ai. 

(a) The map ri : — > Mat„(-ft') given by Ti{x)ij = trji/xixMij) is an 
isomorphism of K-algebras. 

(Hi) If Tp : Ap = Matn{K) is an isomorphism of K-algebras then there 
is a commutative diagram 

(15) Ap^MntniK) 



•7 



/3 



Ai ^^Mat„(K) 

where P is conjugation by some matrix B G Ghn^K). Moreover B 
represents a change of co-ordinates on P"~i taking the Brauer-Severi 
diagram [E P"-^] to its twist [C P"~i] by ^. 

Proof: (i) The element 7 G R^ exists by Corollarv 13.61 The isomor- 
phism .7 is that specified in Lemma f4. 61 

(ii) We must show that ti is a ring homomorphism. Reducing to the 
geometric case we have ti{6t) = Mt- Since 5$ *s = £{S, T)6s+t and 
MsMt = e{S, T)Ms+T the resuh is clear. 

(iii) Let j3 be the isomorphism of i^'-algebras making (fT3|) commute. 
By the Noether-Skolem theorem it is conjugation by some matrix B G 
GK(K). 

Let Qe and G be the theta groups for E[n\ with second invariants 
inv2(0£) = edR^ andinv2(0) = epdR^ . Bv Lemma l4.5l the enveloping 
algebras are Ai and Ap. We interpret the isomorphisms ti : Ai = 
Mat„(i^') and Tp : Ap = Mat„(ii') as representations oi Qe and 6. So 
9^; and 6 are now subgroups of GL„ generated up to scalars by the 
ti{5t), respectively rp(5'r), for T G E[n]. 

Since ti{5t) = Mt the theta group ©£; C GL„ is that determined by 
[E P"-^]. On the other hand Proposition O tells us that 6 C GL„ 
is the theta group for some [C P"^-*^]. Moreover, since G is the twist 
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of 6^; by ^, the proposition also tells us that [C P" ^] is the twist 
of [E P"-i] by ^. The commutativity of ^ shows that 9^^ C GL„ 
and C GL„ are related by conjugation by B. It follows by the 
uniqueness statement of Proposition 15.21 that B represents a change of 
co-ordinates on P"-^ taking [C P""^] to [E P"-^]. □ 

As it stands the method is unsatisfactory, since we have to solve for 
7 e i? = (i? ® K) ^ with = p. By ([7j) the choices for 7 form a 
coset of E[n] inside . This coset is an ii^[?T,]-torsor, which turns out 
to be the twist of E[n] by ^. A glance at Remark 11.231 now suggests 
we should solve for 7 G {R ^ F)^ where F is the field of definition 
of a flex point on C. This is already clear from the conclusions of 
Proposition 15.81 since the i^'-rational point G E gets mapped to a 
flex point on C. These observations motivate the following refinement 
of Proposition 15.81 

Proposition 5.9. Let ^ e H^{K, E[n]) and p e [R^R^ with W2{0 = 
pdR"". LetAi = {R, +,*,), Ap = {R,+,*,p) and F = {R,+,*p). 
(i) Let $ he the E[n\-torsor determined by C,- Then F is the Stale 
algebra of ^. In particular F is a product of field extensions of K. 
(a) There is an isomorphism of F- algebras 

a: Ap®kF Ai®kF 

2 

(Hi) Let Tl : Ai = y[a,tn{K) and Tp : Ap = Mat„(ir) be the isomor- 
phisms of Proposition 15. <^ Then there is a commutative diagram 

(16) ^Mat„(F) 

Ai ®i^F^^Mat„(F) 



where j3 is conjugation by some matrix B G GL„(F) = Map^($, GLn{K)). 
Moreover for each P G $ the matrix Bp G GL„(K) represents a change 
of co-ordinates on P'"-^^ taking the Brauer-Severi diagram [E P"^-*^] 
to its twist [C P"-^] by i. 

PROOF: (i) This is proved in Proposition 14.71 

(ii) We first show that a is a ring homomorphism, i.e. 

2 2 

(1 Er=i *ep y)®ri = J2lj=iirlx *e r*y) ® (r^ *p rj) 

for all x,y G R. Since a does not depend on the choice of basis 
ri, . . . ,r„2 we may reduce to the geometric case. Putting x = 63 and 
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1/ = (5t in (|T7jl it becomes 

eiS,T)p{S,T)6s+T(^Ss+T = e{S,T)6s+T ^ p{S,T)6s+t 

which is a tautology. Since Ap and Ai are central simple algebras (of 
the same dimension) it follows that a is an isomorphism, 
(iii) Let (3 be the isomorphism of F-algebras making the diagram com- 
mute. By the Noether-Skolem theorem (applied to each constituent 
field of F) it is conjugation by some matrix B G GL„(F). 

Let 7 = (1 ® tF)(5) G R ^ F where 5 e R ® R was defined in 
Lemma FS. 11 and Lp : R = F is the isomorphism of underlying ii'- vector 
spaces. Then the isomorphism a : Ap ^ F = Ai ^ F is multiplication 
by 7 in i? ® -F. So for each P G $ we obtain a diagram 

A, — Mat„(Z) 



•7P 



/3p 



^-Mat„(K) 

where .•jp is multiplication by 7p in R^ and /3p is conjugation by 
Bp E GLn{K). We are done by Proposition 15.81 □ 

We summarise the flex algebra method in the following 7 steps. 

Step 1. We embed E — > P"^i via the complete linear system |n.0|. 
The curve E is now defined by homogeneous polynomials /i, . . . , /jy in 
K[xi, . . . ,x„]. 

Step 2. We compute M G GL„(i?) and e G [R ® R)^ as described 
at the start of this subsection. If n is odd then, in the notation of 
Lemma 13. IH we may choose M with M" = and cMr^ = M'^. 
This enables us to take e = e^/^. 

Step 3. Let Ai = {R,+,*s). We compute the isomorphism of K- 
algebras ti : Ai = Matn{K) specified in Proposition 15.81 

Step 4. Let Ap = {R, +, ^^p). We use the Black Box to find an isomor- 
phism of i^-algebras Tp : Ap = Mat„(-ft'). 

Step 5. Let F = {R, +, *p). We compute the composite 

t'^: Ap^ Ai®F ^ Mat„(ir) (g) F = Mat„(F). 

2 

It is given by Tp{x) = X^Li '^li'^^i^) ® ''^i- 

Step 6. We use linear algebra to solve for B G GL„(F) with r'p^x) = 
BTp{x) B-^ for all x e R. 
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Step 7. Let wi, . . . , w„2 be a basis for F as a i^-vector space. Then C 
is defined by the homogeneous polynomials gij G K[xi, . . . ,Xn] with 

Remark 5.10. In Steps 6 and 7 it suffices to work with any constituent 
field of F. But in the generic case Galois acts transitively on the fiex 
points of C. So F is already a field and there is no saving to be made. 

5.3. The Segre embedding method. The third of our algorithms 
leads more directly to equations for C (and avoids the need to compute 
the fiex algebra). Here we confine ourselves to a brief description. 
Further details, including a proof that the method works, will be given 
in the second paper of this series j^. 

Let pdR^ G H correspond to a torsor divisor class pair (C, [D]). 
Even before we use the Black Box, we can write down equations for C 
as a genus one normal curve in P" ~^ with hyperplane section nD. To 
do this we fix a Weierstrass equation for E and write {x{P),y{P)) for 
the co-ordinates of P & E \ {0}. We also write A(Pi, P2) for the slope 
of the chord through Pi, P2 E E \ {0} with Pi + P2 7^ 0, respectively 
of the tangent fine if Pi = P2. We put z = ^i^i where zi, . . . , z„2 are 
indeterminates. Since R = Mapj^{E[n], K) we have 

z{T) = Er=i riiT)zi G K[zi, . . . , Zn2]. 
For T ^ E[n] \ {0} we consider the polynomial 

(x - x{T))z{OY - p{T, -T)z{T)z{-T) 

in K[x, zi, . . . , Zn2]. We define a quadric of type 1 to be the difference 
of any two such polynomials. These quadrics span a i^"-vector subspace 
ofK [zi, . . . , Zn2] of dimension di where 

^ _ f (n2 -3)/2 if n odd, 
^ 1 /2 if n even. 

For T, Ti, T2 G i?[n]\{0} with T1+T2 = T we consider the polynomial 

(At - A(Ti,T2))z(0)^(T) - p(ri, T2)^(Ti);2(r2) 

in K[Xt, Zi, . . . , Zn^]. We define a quadric of type 2 to be the difference 
of any two such polynomials that share the same choice of T. These 
quadrics span a i^T- vector subspace of K[zi, . . . , Zn2] of dimension d2 
where 

^ _ r (n2-l)(n2-3)/2 if n odd, 
^ ~ \ n^(n^ - 4)/2 if n even. 

It is clear that the spaces of quadrics of types 1 and 2 are each Galois 
invariant. We thus obtain a i^T- vector space of quadrics in K[zi, . . . , Zn^] 
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of dimension di + d2 = n'^{'n? — 3)/2. It is shown in the second paper 
of this series j3] that these quadrics generate the homogeneous ideal of 
C C P" embedded hy \nD\. Notice that our formulae for the dimen- 
sion of each vector space of quadrics are easily checked by reduction to 
the geometric case. 

Remarks 5.11. (i) In practice when computing the quadrics defining 
C we work over the constituent fields of R, rather than over K. 

(ii) It is arguably more natural first to give equations for C C F{R) 
and only then to identify F{R) = P" ~^ by means of our choice of basis 
ri, . . . ,r„2 for R. 

(iii) We recall that pdR^ is an element of H C (-R ® R)^/dR^. If we 
multiply p by dj for some j E R^ then the effect on C is that of a 
change of co-ordinates on P" 

(iv) In the case n = 2 we find that C C P'^ is the complete intersection 
of two quadrics of type 1. Our method reduces to the classical number 
field method for 2-descent. 

We now have equations for C C P"^~i embedded by \nD\. It remains 
to compute equations for C C P"^^ embedded by \D\. This is achieved 
in the following 5 steps. 

Step 1. We compute F e R{Ey = Map^(E[n],Z(E)^) with div(FT) = 
n.T — n.O. We fix a local parameter z in the local ring of at and 
scale each of the rational functions Ft to have leading coefficient 1 
when expanded as a Laurent power series in z. 

Step 2. We compute e e {R(g) R^ with 



£(Ti,T2) 



FtAP)Ft,{P-T,) 



for all Ti, T2 G E[n] and P E E \ {0, Ti, Ti + T2}. (This formula for e 
was derived near the end of §3) 

Step 3. Let Ap = {R, +, ^^p). We use the Black Box to find an isomor- 
phism of if-algebras t : Ap = Ma.tn{K). 

Step 4. For each quadric /(^i, . . . , ^^2) computed above we make a 
change of co-ordinates to obtain a quadric g{xii, xu, . . . , a;„„) with 

2 2 

fi'(Er=l^(^i)ll^j'---'Er=l^(^i)nn2;i) = f {Zi, . . . , Zn2) . 

The new quadrics define C as a curve in P(Mat„). 
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Step 5. There is a direct sum decomposition Mat^ = (/«) © {Tr = 0} 
where {Tr = 0} is the subspace of matrices of trace zero. We project 
C to the trace zero subspace. Then C is contained in the rank 1 locus. 
In other words C lies in the image of the Segre embedding 
pn-l ^ (f>n-iy ^p(Mat„). 

We pull back to a curve in P"^i x (P"^^)^ and finally project onto the 
first factor to obtain C P"^^. (In fact, projecting onto the second 
factor gives the dual curve.) 

Remark 5.12. In both the flex algebra method and the Segre embed- 
ding method we have specified particular choices for £ G {R <S) R)^ ■ 
But for the purposes of computing the obstruction algebra, we can use 
any e E {R® R)^ with inv2(0£;) = edR^ . Then after trivialising the 
obstruction algebra we can use the isomorphism of Lemma [4.61 to com- 
pensate for having made a different choice of e. So the method we use 
(Hesse pencil, flex algebra or Segre embedding) has no impact on the 
implementation of the Black Box. 
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